Railway has issued steps for customers whose Google Cloud service-account keys may have been exposed, including replacing the credentials and checking for unauthorized cloud activity after a security incident disclosed Oct. 21.
The company’s Oct. 22 guide advises customers to update the key in Railway and redeploy services that use it. It also recommends comparing Cloud Audit Logs and billing records with expected activity to spot unfamiliar resources, permission changes or charges.
Tokens issued before a key is disabled may remain valid for 60 minutes under Google Cloud’s default settings. An extended token-lifetime policy can allow them to remain valid for up to 12 hours.
Railway says disabling the whole service account can stop access immediately when a rapid cutoff is needed. That action also interrupts every workload that relies on the account.
Railway said its initial incident notice pointed to a possible series of attacks targeting platform companies to reach AI inference providers. It said it would provide updates as it narrowed the incident’s scope, but gave no time for the next update. The new guidance follows the company’s deployment pause after a warning about possible secret exposure.
